Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Investigating Infrastructure and Tactics of Phishing-as-a-Service Platform Sniper Dz

Summary: Unit 42 found over 140,000 phishing websites tied to the free phishing-as-a-service platform Sniper Dz in the past year, with activity surging from July 2024 and primarily targeting US web users. Sniper Dz hides phishing content behind the public proxy server proxymesh[.]com, obfuscates page code, hosts most pages on legitimate SaaS platforms such as Blogspot, and exfiltrates stolen credentials to its own endpoint at raviral[.]com/k_fac.php.

What you should know: Sniper Dz gives away its phishing kit for free and leaves a backdoor in every page, so the credentials your users lose may land in the platform operator's hands regardless of which phisher set the trap. Its Telegram support channel had 7,156 subscribers in August 2024, and one tutorial video had 72,600 views - a subscriber base that size means the templates are already in circulation.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related